In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < 1af000d75b1c96f7cbdf23f14d0ee1c51b12f8e6
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < 5bcc933c6d47d795dab27458b9001c2d97130fd3
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < 4c582ed61325135f841ca93667d7551a8e31e58d
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < c9d8641aea01c3b2516483e128e1f557cfbcf44a
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < 2a77cb320e3998afa5e1ed0e95908b226aae9ed6
12d60c1efc29e19f4dc0dc70cd48ce097fce6447 affected < f6a6c01cbc046f68e6916a7e047a1bc881c8c9ab
Linux Linux affected
Version Status Constraints
5.16 affected —
0 unaffected < 5.16
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1af000d75b1c96f7cbdf23f14d0ee1c51b12f8e6 cve-icon cve-icon
https://git.kernel.org/stable/c/2a77cb320e3998afa5e1ed0e95908b226aae9ed6 cve-icon cve-icon
https://git.kernel.org/stable/c/4c582ed61325135f841ca93667d7551a8e31e58d cve-icon cve-icon
https://git.kernel.org/stable/c/5bcc933c6d47d795dab27458b9001c2d97130fd3 cve-icon cve-icon
https://git.kernel.org/stable/c/c9d8641aea01c3b2516483e128e1f557cfbcf44a cve-icon cve-icon
https://git.kernel.org/stable/c/f6a6c01cbc046f68e6916a7e047a1bc881c8c9ab cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwl_mvm_frob_txf_key_iter() tracks the last matched byte position in loop variable 'i'. When a full key match is found (match == keylen), 'i' points at the last byte of the matched key. The memset start offset should therefore be i + 1 - keylen, not i - keylen; the current code zeroes one byte before the match and leaves the final key byte un-sanitised.
Title wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:10:50.254Z

Reserved: 2026-09-17T15:57:05.660Z

Link: CVE-2026-93064

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:18:00.150

Modified: 2026-09-17T17:18:00.150

Link: CVE-2026-93064

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.